# Some Security Issues

* HTTP sends data in the clear. For real applications that handle sensitive data, we should use HTTPS
  * authenticate server
  * encrypt data sent over network via SSL
* Session hijacking &#x20;
  * Adversary who discovers session ID can take over a session &#x20;
  * Checking the IP address of each request helps mitigate this threat, but doesn’t eliminate it
* SQL injection
  * Malicious user enters input that results in execution of an SQL statement other than the intended one
* Cross-site scripting
  * Malicious user gives input that hides a script in content that others will download
